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Various sources of known reliability are reporting a reemergence of the W97m/Caligula virus. The 
currently-released virus contains the same payload found in the original W97m/Caligula virus, and should 
be recognized by up-to-date anti-virus software. 

Military, federal, state and local governmental and commercial/educational systems have all been 
affected by the W97m/Caligula virus recently; the potential for further infection is significant due to 
increased ongoing release activity. 

The characteristics of the W97m/Caligula include: 

• W97m.Cali.a is a macro virus. This Microsoft Word 97 macro virus will add a VBA module called 
Caligula into infected documents or templates. 

• While infecting a document or global template, this macro virus uses a temporary text file 
c:\io.vxd. 

• While closing an infected document on the thirty first day of any month, it displays a message box 
entitled W97m/Caligula (c) opic [codebreakers 1998]. 

• The currently-released W97m/Caligula virus propagates in the same manner as the original 
W97m/Caligula virus. The virus is propagated via infected document exchange. This exchange 
may take place via diskette, local drive, network drive, or e-mail attachment. 

• The payload of W97m/Caligula virus is not currently destructive. The virus searches for PGP 
secret key ring files (secring.skr) and attempts to transmit any located files to a remote host 
machine. Due to this attempt to obtain keys to encryption software, it can be reasonably deduced 
that the primary danger is loss of information. 

Inasmuch as this virus has been in widespread circulation for nearly a year, all modern and updated 
commercial anti-virus packages should detect and disable this virus. Additional information about this 
virus is available at the web sites of Symantec (www.symantec.com), Network Associates (www.nai.com), 
and Trend Micro (www.antivirus.com). 

The NIPC recommends system administrators to update installed anti-virus software immediately and 
take other appropriate measures to prevent infection by and spread of W97m/Caligula virus. NIPC 
recommends widest possible dissemination of this advisory throughout federal, state and local 
government, military, and private organizations. Please report any information on and damage from 
infections by this virus to your local FBI office, the NIPC, or incident response group, as appropriate. The 
NIPC Watch and Warning Unit can be reached 24 hours a day at (202) 323-3204/3205/3206 or (202) 
323-2204/2206 (STU-III) or by e-mail at nipc.watch@fbi.gov. 


